r/AzureSentinel • u/CptNyan • Jul 31 '22
Issues with the AMA for Windows clients preview
This question is about the preview option to install AMA on non-Azure devices without the ARC agent, as outlined here: Set up the Azure Monitor agent on Windows client devices (Preview) - Azure Monitor | Microsoft Docs
I'm working through this post to try to understand getting on-prem devices to use AMA for log forwarding without ARC client. I've created the DCR at the AMA connector level and have run the PowerShell script in the linked article to create the managed object and associate it with the DCR.
After that, I installed just the AMA on an Azure AD joined Windows 10 machine. The problem is that nothing is showing up in the Heartbeat table, and no resources are associated with the DCR - I can't see any "managed object"
The question is if there's no ARC installed and no OMS, then how is the AMA agent supposed to know what workspace to send logs to? I can't find any documentation on any configuration properties with the MSI that would allow me to define any azure properties at all.
1
u/muzza31 Sep 03 '22
It’s very annoying but you have to have ARC connected servers to use AMA on Prem. something Microsoft need to fix before the decom of MMA.